{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Mitel vulnerabilities","home_page_url":"https://patchfirst.co/vendor/mitel/","feed_url":"https://patchfirst.co/feed/vendor/mitel.json","description":"New and newly exploited Mitel CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2024-41710#kev","url":"https://patchfirst.co/cve/CVE-2024-41710/","title":"[KEV] CVE-2024-41710: Mitel SIP Phones Argument Injection Vulnerability","content_text":"Mitel · SIP Phones. In CISA KEV since 2025-02-12. ENISA EUVD lists it as exploited. EPSS 41.6% (higher than 98.7% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 67.8 of 100.","summary":"Mitel SIP Phones Argument Injection Vulnerability","date_published":"2025-02-12T00:00:00.000Z","date_modified":"2026-06-17T07:48:05.000Z","tags":["kev","public-exploit","T1068","T1059"],"_patchfirst":{"reason":"kev","priority":67.8,"kev":{"dateAdded":"2025-02-12","ransomware":false},"epss":{"score":0.41646,"percentile":0.98681},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Mitel","product":"SIP Phones","techniqueIds":["T1068","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-41713#kev","url":"https://patchfirst.co/cve/CVE-2024-41713/","title":"[KEV] CVE-2024-41713: Mitel MiCollab Path Traversal Vulnerability","content_text":"Mitel · MiCollab. In CISA KEV since 2025-01-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS 97.2% (higher than 99.89% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1005 Data from Local System. Priority 79.3 of 100.","summary":"Mitel MiCollab Path Traversal Vulnerability","date_published":"2025-01-07T00:00:00.000Z","date_modified":"2026-08-04T05:16:30.000Z","tags":["kev","ransomware","public-exploit","T1068","T1005"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2025-01-07","ransomware":true},"epss":{"score":0.97209,"percentile":0.99895},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Mitel","product":"MiCollab","techniqueIds":["T1068","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-55550#kev","url":"https://patchfirst.co/cve/CVE-2024-55550/","title":"[KEV] CVE-2024-55550: Mitel MiCollab Path Traversal Vulnerability","content_text":"Mitel · MiCollab. In CISA KEV since 2025-01-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS 38.2% (higher than 98.6% of CVEs). CVSS 2.7 LOW. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1041 Exfiltration Over C2 Channel. Priority 74.6 of 100.","summary":"Mitel MiCollab Path Traversal Vulnerability","date_published":"2025-01-07T00:00:00.000Z","date_modified":"2026-08-04T05:16:31.000Z","tags":["kev","ransomware","public-exploit","T1190","T1005","T1041"],"_patchfirst":{"reason":"kev","priority":74.6,"kev":{"dateAdded":"2025-01-07","ransomware":true},"epss":{"score":0.38155,"percentile":0.98557},"cvss":{"score":2.7,"severity":"LOW","version":"3.1"},"vendor":"Mitel","product":"MiCollab","techniqueIds":["T1190","T1005","T1041"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-41223#kev","url":"https://patchfirst.co/cve/CVE-2022-41223/","title":"[KEV] CVE-2022-41223: Mitel MiVoice Connect Code Injection Vulnerability","content_text":"Mitel · MiVoice Connect. In CISA KEV since 2023-02-21, known ransomware use. ENISA EUVD lists it as exploited. EPSS 10.7% (higher than 95.8% of CVEs). CVSS 6.8 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 71.9 of 100.","summary":"Mitel MiVoice Connect Code Injection Vulnerability","date_published":"2023-02-21T00:00:00.000Z","date_modified":"2026-06-17T05:02:49.000Z","tags":["kev","ransomware","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":71.9,"kev":{"dateAdded":"2023-02-21","ransomware":true},"epss":{"score":0.10657,"percentile":0.95793},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1"},"vendor":"Mitel","product":"MiVoice Connect","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-40765#kev","url":"https://patchfirst.co/cve/CVE-2022-40765/","title":"[KEV] CVE-2022-40765: Mitel MiVoice Connect Command Injection Vulnerability","content_text":"Mitel · MiVoice Connect. In CISA KEV since 2023-02-21, known ransomware use. ENISA EUVD lists it as exploited. EPSS 10.6% (higher than 95.8% of CVEs). CVSS 6.8 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 71.9 of 100.","summary":"Mitel MiVoice Connect Command Injection Vulnerability","date_published":"2023-02-21T00:00:00.000Z","date_modified":"2026-06-17T05:02:00.000Z","tags":["kev","ransomware","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":71.9,"kev":{"dateAdded":"2023-02-21","ransomware":true},"epss":{"score":0.10566,"percentile":0.95772},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1"},"vendor":"Mitel","product":"MiVoice Connect","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-29499#kev","url":"https://patchfirst.co/cve/CVE-2022-29499/","title":"[KEV] CVE-2022-29499: Mitel MiVoice Connect Data Validation Vulnerability","content_text":"Mitel · MiVoice Connect. In CISA KEV since 2022-06-27, known ransomware use. ENISA EUVD lists it as exploited. EPSS 55.2% (higher than 99.03% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.7 of 100.","summary":"Mitel MiVoice Connect Data Validation Vulnerability","date_published":"2022-06-27T00:00:00.000Z","date_modified":"2026-08-06T05:16:37.000Z","tags":["kev","ransomware","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.7,"kev":{"dateAdded":"2022-06-27","ransomware":true},"epss":{"score":0.55242,"percentile":0.99028},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Mitel","product":"MiVoice Connect","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-26143#kev","url":"https://patchfirst.co/cve/CVE-2022-26143/","title":"[KEV] CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability","content_text":"Mitel · MiCollab, MiVoice Business Express. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 87.3% (higher than 99.75% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1498 Network Denial of Service. Priority 69.8 of 100.","summary":"MiCollab, MiVoice Business Express Access Control Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T04:34:46.000Z","tags":["kev","public-exploit","T1190","T1498"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.87325,"percentile":0.99753},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Mitel","product":"MiCollab, MiVoice Business Express","techniqueIds":["T1190","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}